2026 CVEs (page 109)
Page 109 of 451 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57852 | Medium | 5.6 | 2026-07-20 | Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled… |
CVE-2026-57495 | | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1… | |
CVE-2026-57494 | | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail age… | |
CVE-2026-55550 | High | 7.1 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application ser… |
CVE-2026-55544 | High | 7.6 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations ove… |
CVE-2026-52656 | Critical | 9.8 | 2026-07-20 | An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a… |
CVE-2026-51385 | Medium | 6.9 | 2026-07-20 | An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url, safe_fetch, _build… |
CVE-2026-51031 | High | 7.5 | 2026-07-20 | FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain… |
CVE-2026-51025 | Medium | 6.1 | 2026-07-20 | Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.j… |
CVE-2026-47255 | High | 8.2 | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had… |
CVE-2026-47144 | Medium | 5.5 | 2026-07-20 | Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `s… |
CVE-2026-47134 | | 2026-07-20 | ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy data… | |
CVE-2026-47133 | | 2026-07-20 | ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite… | |
CVE-2026-47128 | Medium | 6.1 | 2026-07-20 | nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to loca… |
CVE-2026-16324 | High | 7.3 | 2026-07-20 | A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp… |
CVE-2026-12900 | Medium | 6.4 | 2026-07-20 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `uagb/image` bloc… |
CVE-2026-64651 | | 2026-07-20 | The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests f… | |
CVE-2026-64650 | | 2026-07-20 | The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29… | |
CVE-2026-58624 | Medium | 5.4 | 2026-07-20 | Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.ssh… |
CVE-2026-56624 | High | 7.3 | 2026-07-20 | Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side Open… |
CVE-2026-56623 | High | 7.1 | 2026-07-20 | Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server impl… |
CVE-2026-56452 | High | 7.5 | 2026-07-20 | Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of… |
CVE-2026-55219 | Medium | 5.3 | 2026-07-20 | Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.5, the credit payment implementation in app/L… |
CVE-2026-53596 | Medium | 5.3 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforc… |
CVE-2026-53595 | Critical | 9.4 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invi… |
CVE-2026-53594 | Medium | 4.9 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Logs` feature uses the bundled `rap2hpout… |
CVE-2026-47198 | High | 8.5 | 2026-07-20 | Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters… |
CVE-2026-47130 | High | 7.1 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerabi… |
CVE-2026-47129 | High | 8.1 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the `activ… |
CVE-2026-44585 | Medium | 5.4 | 2026-07-20 | Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a use… |
CVE-2026-44584 | Medium | 4.3 | 2026-07-20 | Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to in… |
CVE-2026-44583 | Medium | 5.3 | 2026-07-20 | Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/pa… |
CVE-2026-13381 | High | 8.1 | 2026-07-20 | VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker… |
CVE-2026-13380 | High | 7.5 | 2026-07-20 | VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are p… |
CVE-2026-63767 | Critical | 9.8 | 2026-07-20 | ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute… |
CVE-2026-63766 | Critical | 9.8 | 2026-07-20 | GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitiz… |
CVE-2026-53593 | High | 8.8 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploa… |
CVE-2026-53592 | Medium | 4.6 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` function `/public/js/… |
CVE-2026-53591 | High | 8.6 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages in… |
CVE-2026-44231 | Critical | 9.1 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information discl… |
CVE-2026-44230 | Medium | 6.1 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6… |
CVE-2026-44229 | Medium | 5.4 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Sit… |
CVE-2026-16337 | | 2026-07-20 | Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privil… | |
CVE-2026-15788 | High | 7.5 | 2026-07-20 | BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A… |
CVE-2026-64619 | High | 7.5 | 2026-07-20 | FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttli… |
CVE-2026-64194 | High | 7.5 | 2026-07-20 | Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compres… |
CVE-2026-64193 | Critical | 9.8 | 2026-07-20 | Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXT… |
CVE-2026-63771 | High | 7.1 | 2026-07-20 | Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the… |
CVE-2026-63770 | High | 7.5 | 2026-07-20 | Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lo… |
CVE-2026-63769 | High | 7.7 | 2026-07-20 | Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to mak… |
CVE-2026-63768 | Medium | 4.3 | 2026-07-20 | cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary… |
CVE-2026-63731 | High | 7.7 | 2026-07-20 | HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal de… |
CVE-2026-63730 | Medium | 5.0 | 2026-07-20 | HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbi… |
CVE-2026-63108 | High | 8.8 | 2026-07-20 | Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enfor… |
CVE-2026-63107 | High | 7.7 | 2026-07-20 | LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated us… |
CVE-2026-62414 | Critical | 9.1 | 2026-07-20 | Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK does not properly apply access contr… |
CVE-2026-61901 | Medium | 6.1 | 2026-07-20 | Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop is vulnerable to an open redirect. |
CVE-2026-61900 | | 2026-07-20 | Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6 - The Joomla extension JDownloads is vulnerable to an una… | |
CVE-2026-61425 | | 2026-07-20 | Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially lea… | |
CVE-2026-61424 | | 2026-07-20 | Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to… | |
CVE-2026-60034 | | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to a stored XSS vulnerabil… | |
CVE-2026-60033 | | 2026-07-20 | Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to an SSRF vulnerability… | |
CVE-2026-60032 | | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbit… | |
CVE-2026-60031 | | 2026-07-20 | Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an inform… | |
CVE-2026-60030 | | 2026-07-20 | Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vul… | |
CVE-2026-60029 | | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an auth… | |
CVE-2026-60028 | | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an auth… | |
CVE-2026-60027 | | 2026-07-20 | Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vul… | |
CVE-2026-60026 | | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to… | |
CVE-2026-48389 | High | 7.8 | 2026-07-20 | DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contex… |
CVE-2026-12341 | High | 8.8 | 2026-07-20 | This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper val… |
CVE-2026-8170 | | 2026-07-20 | The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of… | |
CVE-2026-8169 | | 2026-07-20 | ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insu… | |
CVE-2026-64612 | High | 7.5 | 2026-07-20 | A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causi… |
CVE-2026-55639 | Medium | 5.3 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Conne… |
CVE-2026-55626 | High | 8.0 | 2026-07-20 | xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sock… |
CVE-2026-48812 | High | 7.5 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's attachment download route skips token… |
CVE-2026-46715 | | 2026-07-20 | Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh a… | |
CVE-2026-45295 | Medium | 6.5 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint `GET /thread/read/{conv… |
CVE-2026-44228 | Medium | 5.4 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS)… |
CVE-2026-44227 | Medium | 6.1 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS… |
CVE-2026-39878 | Critical | 9.3 | 2026-07-20 | Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated atta… |
CVE-2026-34239 | | 2026-07-20 | Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected o… | |
CVE-2026-26483 | Medium | 6.1 | 2026-07-20 | Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template management functionality. The application fails… |
CVE-2026-64207 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: net/sched: dualpi2: fix GSO backlog accounting When DualPI2 splits a GSO skb into N segme… |
CVE-2026-64206 | High | 8.8 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock l2cap_conn_del() takes… |
CVE-2026-64205 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A severe livelock and subs… |
CVE-2026-64192 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized When CONFIG_B… |
CVE-2026-64191 | High | 7.8 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA ca… |
CVE-2026-64190 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in team_xmit during mode change __team_change_mod… |
CVE-2026-64189 | High | 7.8 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set… |
CVE-2026-64188 | High | 7.8 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() rmnet_dellink() remo… |
CVE-2026-64187 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transacti… |
CVE-2026-58484 | High | 7.1 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` a… |
CVE-2026-58482 | Medium | 5.9 | 2026-07-20 | Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is… |
CVE-2026-58481 | Medium | 6.5 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `ba… |
CVE-2026-58414 | Medium | 5.5 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects files using `_collectB… |
CVE-2026-58413 | Medium | 6.1 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with… |
CVE-2026-55645 | Medium | 6.5 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connectio… |
CVE-2026-55238 | Medium | 5.3 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capa… |